A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:11:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix possible OOB write in extract_time_sync_ftm_offset_event_tlv

Browse source 
In extract_time_sync_ftm_offset_event_tlv there is a possible
OOB write when value of num_qtime received from firmware is
greater than FTM_TIME_SYNC_QTIME_PAIR_MAX.

Fix is to add a sanity check for value of num_qtime received from
firmware to avoid the OOB write.

Change-Id: I6e57b1d716992d1a3c7d2f7ea911fefcbfbeff34
CRs-Fixed: 3033509
This commit is contained in:
Surabhi Vishnoi 2021-09-14 10:55:14 +05:30 • committed by Gerrit - the friendly Code Review server
commit a2b6f19936
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
wmi/src/wmi_unified_tlv.c
View file

@ -14549,6 +14549,9 @@ extract_time_sync_ftm_offset_event_tlv(wmi_unified_t wmi, void *buf,
param->vdev_id = resp_event->vdev_id;
param->num_qtime = param_buf->num_audio_sync_q_master_slave_times;
if (param->num_qtime > FTM_TIME_SYNC_QTIME_PAIR_MAX)
param->num_qtime = FTM_TIME_SYNC_QTIME_PAIR_MAX;
q_pair = param_buf->audio_sync_q_master_slave_times;
if (!q_pair) {
wmi_err("Invalid q_master_slave_times buffer");